qa(checklist): access-security — pin the Tier 1 clauses the 18.2.0 sweep scored partial at the layer their oracle names (18 items)

Filing gate: ③ a maintainer-directed task — in the 18.2.0 wave-2 session (2026-10-27) the PM proposed per-area pin-upgrade cards for the PARTIAL coverage, starting with access-security, api-backend and records-forms; the maintainer answered, verbatim: 「同意」.
Business reason: in the 18.2.0 release-candidate Tier 1 run (#26468) every pin was green, yet these access-security items scored PARTIAL — their pins assert the clause below the layer the clause's oracle names (unit / in-process, where the clause wants a live HTTP boot or the browser), or no pin asserts the clause at all. Each release sweep re-pays that gap as live legs or carries it as partial; pinning at the oracle's layer turns it into a standing, re-runnable proof.
Reader: the lane owning docs/qa/platform-checklist/** and packages/qa/dogfood/** (domain:devx): add or extend the pins, then revise each item's automated.ref (bump revision, append history citing this card) and keep node scripts/check-platform-checklist.mjs green.
Dedupe (open AND closed): "pin upgrade checklist area automated.ref oracle layer partial access-security api-backend records-forms" → 36 hits, none a pin-upgrade card; the nearest are the closed wave-1 ledger-edit cards #25835 / #25846 (accuracy edits, not pins).

Items and clauses (from #26468's close-out, wave anchor #25807)

Each line is the record's own Parked-on: line: "partial" = a pin asserts the clause below its oracle's layer; "no pin" / "unpinned / half-asserted" = nothing asserts it at any layer. Per-clause reasons (pin file, layer, missing layer) are in #26468's detail comments.

Parked-on: #25807 · access-security.rls-both-sides · 6 clause(s) unpinned/half-asserted/procedural, live leg not driven
Parked-on: #25807 · access-security.write-path-guards · 5 clause(s) unpinned/half-asserted/procedural, live leg not driven
Parked-on: #25807 · access-security.crud-permission-matrix · 6 clause(s) unpinned/half-asserted/procedural, live leg not driven
Parked-on: #25807 · access-security.owd-sharing-matrix · 5 clause(s) unpinned/half-asserted/procedural, live leg not driven
Parked-on: #25807 · access-security.fls-mask-and-strip · 1 clause(s) pinned below the oracle's layer; 3 clause(s) unpinned/half-asserted/procedural, live leg not driven
Parked-on: #25807 · access-security.anonymous-deny-surfaces · 3 clause(s) unpinned/half-asserted/procedural, live leg not driven
Parked-on: #25807 · access-security.public-form-withdrawal-layers · 5 clause(s) unpinned/half-asserted/procedural, live leg not driven
Parked-on: #25807 · access-security.activation-write-operator-gate · 4 clause(s) pinned below the oracle's layer; 3 clause(s) unpinned/half-asserted/procedural, live leg not driven
Parked-on: #25807 · access-security.platform-owner-email-anchor · 4 clause(s) pinned below the oracle's layer; 3 clause(s) unpinned/half-asserted/procedural, live leg not driven
Parked-on: #25807 · access-security.record-view-read-audit · 4 clause(s) pinned below the oracle's layer; 3 clause(s) unpinned/half-asserted/procedural, live leg not driven
Parked-on: #25807 · access-security.anonymous-floor-v18-doors · 1 clause(s) pinned below the oracle's layer; 2 clause(s) unpinned/half-asserted/procedural, live leg not driven
Parked-on: #25807 · access-security.meta-authoring-trail-and-audience-gates · 1 clause(s) pinned below the oracle's layer; 1 clause(s) unpinned/half-asserted/procedural, live leg not driven
Parked-on: #25807 · access-security.security-catalog-activation-and-clone-doors · 2 clause(s) pinned below the oracle's layer
Parked-on: #25807 · access-security.security-catalog-one-holder-and-boot-report · 2 clause(s) pinned below the oracle's layer; 1 clause(s) unpinned/half-asserted/procedural, live leg not driven
Parked-on: #25807 · access-security.grant-table-write-contract · 4 clause(s) pinned below the oracle's layer
Parked-on: #25807 · access-security.parent-and-organization-write-guards · 3 clause(s) pinned below the oracle's layer
Parked-on: #25807 · access-security.deployment-tables-platform-only · 2 clause(s) unpinned/half-asserted/procedural, live leg not driven
Parked-on: #25807 · access-security.share-link-combined-gates · 4 clause(s) pinned below the oracle's layer

Done when

Every clause listed above either carries a pin at the layer its oracle names (an HTTP-in-process dogfood case is the usual shape for an api oracle; a live-boot or Playwright spec for browser), or the item text says why it stays a live leg.
Each touched item's automated.ref names the new pin, with revision bumped and a history row citing this card.
Procedural clauses (scoring rules, record-completeness rules) are left as they are — they are not pinnable and are not part of this card.

Generated by Claude Code

Triage: first grade — `tests` · `priority:p2` · `domain:devx` · `area:devpath` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-27T08:57Z

⛔ Not a claim, ⛔ not a dispatch.

p2, maintainer-directed (「同意」 in the wave-2 session): pin the 18 access-security Tier 1 clauses the 18.2.0 sweep scored PARTIAL at the layer their oracle names (live HTTP or browser), in packages/qa/dogfood/**, with the checklist item revisions bumped. ⛔ No new CI lane: the dogfood legs run where they run today (dispatch-gates lists Dogfood Regression Gate as "scheduled BY YOUR PATHS" for a route-ledger.ts change, but its if: skips pull_request and merge_group, so neither PR CI nor the derived commands run the dogfood pins (main red after #24009) #24073). It may land in slices of about 5 items per PR.

Generated by Claude Code

Claim: PM loop round 6 · 2026-10-27T14:49Z
Session: session_01JQwxbWKBLcQCG7FBS17aMA (card thread cmsg_01U5RdnAAmkSQmZbqh6FtqZ8YSjPf3hTSLEBa52VUBikb4, dispatched by seat session session_01JQwxbaFpnMwgpCgneKe2qS)
Account: os-warren (the seat's linked user; the card's assignee)
Branch: claude/project-thread-czmdl5 (the harness-pinned branch of the card thread; it names no issue, so this claim is the identity record)
Worktree: objectstack-issue-26571
Domain: domain:devx
Seat: domain:devx#1
File surface: docs/qa/platform-checklist/areas/access-security.json (the slice's items: automated.ref, revision, history) and new or extended pins under packages/qa/dogfood/**; first slice of about 5 of the 18 items, PR Refs #26571 (items …). ⛔ No new CI lane, no product change, no other area file (stop on breach)
Container & model: L, mode:thread (Warren's 「opus 很多，并发5」, 2026-10-27), model: default (dispatch-gates --tier: "no path-derived mandate … default opus"), effort: xhigh
Clause-②: no
Metadata-protocol: none
Responsibility: n/a — maintainer-directed filing (wave-2 session, quoted in the card body); triage 6437710517
Thread-read: 6437710517
Premise: holds by the paths (the card's items are read on origin/main by the thread before its first edit; its report records any item already pinned)
Serial constraints cleared: none blocking. Draft #26337 touches docs/qa/platform-checklist/coverage.json and packages/qa/dogfood/test (merge origin/main before each push); sibling card threads #26571, #26572, #26573 and #26621 each edit their own areas/<area>.json; no other devx seat is seated

Generated by Claude Code

test(dogfood): pin access-security slice 1 clauses at the api oracle'…

os-dev-report

{
  "issue": 26571,
  "status": "done",
  "slice": "1 of about 4: access-security.rls-both-sides, access-security.write-path-guards, access-security.crud-permission-matrix, access-security.owd-sharing-matrix, access-security.fls-mask-and-strip (the first five items in the card's order). PR says Refs #26571, not a closing keyword; 13 items remain for later slices.",
  "branch": "claude/project-thread-czmdl5",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/26797",
  "session": "session_01JQwxbWKBLcQCG7FBS17aMA",
  "premise_still_valid": true,
  "summary": "19 PARTIAL clauses of the five items now carry pins at their oracle's layer (api, the in-process HTTP stack), all in packages/qa/dogfood/**: rls-both-sides a2/a3/n0 and owd-sharing-matrix a0/a1 (admin re-reads after refused foreign PATCHes, admin full list, non-2xx by-id reads); owd-sharing-matrix a4/a5 in a new shared-showcase file on the stock showcase_contributor C1/C2 and showcase_auditor grants; write-path-guards a0 (INSERT droppedFields + header), a4 (member REST createMany owner stamping), a5 (mixed updateMany per-row droppedFields, the line's product field), a6 (per-row validation under continueOnError, default-stop contrast), n0 (admin forge-insert and disown); crud-permission-matrix a3 (auditor VAMA over inquiry, invoice, line vs a contributor), n0 (one denied cell per set re-run as admin) and a0/a1/a6 over the 16 showcase_field_ops_delegate x sys_* cells (sys_user create/delete 405 for delegate and admin); fls-mask-and-strip a0 (name re-read) and a2 (admin budget write). Each item's automated.ref is rewritten clause by clause, revision +1, history row cites #26571. Left with reasons in the refs: rls a5/n1/n2 and owd a6 procedural, crud a5 blocked(fixture) per knownGaps[2], fls a3 and the UI half of a4 a browser leg (no browser in dogfood, no new CI lane). No product code changed.",
  "tests": "Head fd634911 (origin/main merged incl. #26337, closure rebuilt): the 8 touched dogfood files under os-verify-lock: Test Files 8 passed (8), Tests 103 passed (103), the lock's VERDICT line exit 0; pnpm typecheck in packages/qa/dogfood exit 0 (6 GB heap; the default 2 GB heap OOMs on this package, 4 GB was not tried). Same 103/103 on b9b2d0ed and on the pre-merge head. No ablation: no tested behaviour changed (tests and ledger text only).",
  "gates": "dispatch-gates --commands at fd634911 derived 55; all 55 exit 0; --ran reconciles 55 derived, 55 run, 0 NOT-MEASURED. On the earlier head b9b2d0ed two families first exited 3 on prerequisites (check-plugin-teardown-shape --self-test needed commit 621a4876 fetched into the shallow clone; check:dual-build-cjs-loads needed dists) and both exit 0 on the final run. check-platform-checklist OK (16 areas, 329 items). PR check-runs: pending at report time.",
  "files_changed": "docs/qa/platform-checklist/areas/access-security.json; packages/qa/dogfood/vitest.config.ts; packages/qa/dogfood/test/showcase-invoice-line-contributor-pair.dogfood.test.ts (new); packages/qa/dogfood/test/showcase-private-owd.dogfood.test.ts; packages/qa/dogfood/test/showcase-public-read-owd.dogfood.test.ts; packages/qa/dogfood/test/showcase-permission-zoo.dogfood.test.ts; packages/qa/dogfood/test/showcase-static-readonly.dogfood.test.ts; packages/qa/dogfood/test/showcase-readonly-when-parent.dogfood.test.ts; packages/qa/dogfood/test/owner-anchor-and-bulk-writes.dogfood.test.ts; packages/qa/dogfood/test/showcase-crud-persona-matrix.dogfood.test.ts",
  "deviations": "PR body folds the PR template headings (Why, Human Minimum) into the os-dev section order. The slice is the first five items in the card's order; the dispatch named only the size. owd-sharing-matrix's ref also cites existing crud-matrix cases that already pin its a2/a3 (not in the PARTIAL list), correcting revision 5's 'no pin'. crud-persona-matrix's header comment and one test title were reworded to say the delegate rows are now driven by a dedicated case.",
  "body_amendments": "none",
  "dogfood_battery": "n/a: no ! in the PR title and no (narrowing) arm",
  "mcp_calls": "0",
  "api_writes": "2 relay writes: pr_create (fleet-write run 40538617886, PR 26797, assignee os-warren, label skip-changeset, 7660 bytes sent and stored identical) and this os-dev-report comment via post-stamped; plus git push (not a REST write)",
  "open_questions": [],
  "out_of_scope_findings": [
    "carrier: #26571 later slices or seat · noted, not filed: crud-permission-matrix acceptance[6].verify and steps[6] still describe the 16 delegate cells as hand-driven; item text outside this slice's claimed edit surface (automated.ref, revision, history). The history row says so."
  ]
}

Generated by Claude Code

ACCEPT → PR #26797 comment 6447480991

Generated by Claude Code

Landed: slice 1 via PR #26797, merged as c8583f80ac · 2026-10-27T16:50Z

Five items are pinned at their oracle layer: rls-both-sides, write-path-guards, crud-permission-matrix, owd-sharing-matrix and fls-mask-and-strip. ACCEPT → PR #26797 comment 6447480991. The card stays pm:dispatched, and the same card thread takes slice 2 on the same branch (claim on this card still holds). 13 items remain.

Generated by Claude Code

os-dev-report

{
  "issue": 26571,
  "status": "done",
  "slice": "2 of about 4: access-security.anonymous-deny-surfaces, access-security.public-form-withdrawal-layers, access-security.activation-write-operator-gate, access-security.platform-owner-email-anchor, access-security.record-view-read-audit (the next five unpinned items in the card's order). PR says Refs #26571, not a closing keyword; 8 items remain for later slices.",
  "branch": "claude/project-thread-czmdl5",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/26823",
  "session": "session_01JQwxbWKBLcQCG7FBS17aMA",
  "premise_still_valid": true,
  "summary": "24 PARTIAL clauses of the five items now carry pins at their oracle's layer (api: the in-process HTTP stack; log: process output captured during the boot), all in packages/qa/dogfood/**. Extended: showcase-anonymous-deny-surfaces (a4 member /meta 200, a5 anonymous GET /forms/contact-us 200 with the form on the platform-default boot, n0 the flow's GET answers 200 after the refused anonymous DELETE) and showcase-public-form-withdrawal-layers (a0's no-organization read serving allowAnonymous false, n1 the save message names no organization id). New isolated files: activation-write-operator-gate-single (a0/a1 each door's exact tier sentence, a2 invalid body still 403 and no ledger row, a3 a runtime-authored manage_metadata holder without platform_admin admitted at both doors with no organization_id key on the rows, n0/n1/n2); platform-owner-email-anchor (one database restarted per value in the steps' order with the datasource admin routes mounted as serve does: a0/a1/a2 refusals with the admin's 200 beside them, a4's live leg, a3's [authz] line captured once with M verified and holding no grant, n0 ADMIN_STANDING_NON_TABLE_INPUTS); record-view-read-audit (stock option-less AuditPlugin a0, configured readAudit [showcase_account, sys_job] a1-a4 incl. install line, exclusion warning and the row's fields and view-instant created_at). Each item's automated.ref is rewritten clause by clause, revision +1, history row cites #26571. Left with reasons in the refs: procedural clauses, the no-stock-fixture withdrawal a2-a5, the walled-boot activation a4, and the test-oracle clauses. No product code changed.",
  "tests": "Head f3aa3510 (origin/main c8583f80 contained, closure rebuilt): the 5 touched dogfood files under os-verify-lock: Test Files 5 passed (5), Tests 103 passed (103), the lock's VERDICT line exit 0; pnpm typecheck in packages/qa/dogfood exit 0 (6 GB heap). No ablation: no tested behaviour changed (tests and ledger text only). First run of the owner-email pin measured two things that shaped it: GET /datasources is 404 on a bare bootShowcase (the harness composes the datasource-admin service but not its routes), and a FRESH database booted with a well-formed OS_PLATFORM_OWNER_EMAIL promotes only the declared owner, so the seeded admin answers 403; the pin now mounts the routes and restarts one database first booted unset, as the item's steps do.",
  "gates": "dispatch-gates --commands at the slice head derived 55; all 55 exit 0; --ran reconciles 55 derived, 55 run, 0 NOT-MEASURED. check-platform-checklist OK (16 areas, 329 items). PR check-runs: pending at report time.",
  "files_changed": "docs/qa/platform-checklist/areas/access-security.json; packages/qa/dogfood/test/showcase-anonymous-deny-surfaces.dogfood.test.ts; packages/qa/dogfood/test/showcase-public-form-withdrawal-layers.dogfood.test.ts; packages/qa/dogfood/test/activation-write-operator-gate-single.dogfood.test.ts (new); packages/qa/dogfood/test/platform-owner-email-anchor.dogfood.test.ts (new); packages/qa/dogfood/test/record-view-read-audit.dogfood.test.ts (new)",
  "deviations": "PR body folds the PR template headings (Why, Human Minimum) into the os-dev section order. record-view-read-audit's configured half boots through bootShowcase extraPlugins instead of the knownGaps scratch-copy recipe (same constructor call as the docs snippet). The first local commit carried the card relation in its message; the push hook refused it and the unpublished commit was reworded before the first push.",
  "body_amendments": "none",
  "dogfood_battery": "n/a: no ! in the PR title and no (narrowing) arm",
  "mcp_calls": "0",
  "api_writes": "2 relay writes: pr_create (fleet-write run 40552783696, PR 26823, draft, assignee os-warren, label skip-changeset, 8423 bytes sent and stored identical) and this os-dev-report comment via post-stamped; plus git push (not a REST write)",
  "open_questions": [],
  "out_of_scope_findings": [
    "carrier: #26571 later slices or seat · noted, not filed: activation-write-operator-gate, platform-owner-email-anchor and record-view-read-audit keep automated.kind 'unit' although their refs now lead with a dogfood pin; kind is outside this slice's claimed edit surface (automated.ref, revision, history). The history rows say so.",
    "carrier: #26571 seat · noted, not filed: platform-owner-email-anchor's fixtures text says each variant restarts the process, and the measured reason the restart must reuse one database (a fresh database with a well-formed variable promotes only the declared owner) is not in the item's text; the new ref records it."
  ]
}

Generated by Claude Code

ACCEPT → PR #26823 comment 6450801106

Generated by Claude Code

Landed: slice 2 via PR #26823, merged as 5787df4d4b · 2026-10-27T19:39Z

Five items are pinned at their oracle layer: anonymous-deny-surfaces, public-form-withdrawal-layers, activation-write-operator-gate, platform-owner-email-anchor and record-view-read-audit. ACCEPT → PR #26823 comment 6450801106. The card stays pm:dispatched, and the same card thread takes slice 3 on the same branch (claim on this card still holds). 8 items remain.

Generated by Claude Code

os-dev-report

{
  "issue": 26571,
  "status": "done",
  "slice": "3 of 4: access-security.anonymous-floor-v18-doors, access-security.meta-authoring-trail-and-audience-gates, access-security.security-catalog-activation-and-clone-doors, access-security.security-catalog-one-holder-and-boot-report, access-security.grant-table-write-contract (the seat's slice-3 order), plus automated.kind corrections. PR says Refs #26571, not a closing keyword; 3 items remain for slice 4 (parent-and-organization-write-guards, deployment-tables-platform-only, share-link-combined-gates).",
  "branch": "claude/project-thread-czmdl5",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/26905",
  "session": "session_01JQwxbWKBLcQCG7FBS17aMA",
  "premise_still_valid": true,
  "summary": "14 PARTIAL clauses now carry pins at their oracle's layer (api: in-process HTTP; log: process output across boots), all in packages/qa/dogfood/**. New isolated files: anonymous-floor-v18-doors (a1 error.code on steps[0]'s six doors with the admin's 200 control except /keys, a3 bogus share-link token not 401, a4 forged owner_id/status submit answers 201 with exactly {id} and stores neither); meta-view-audience-alternate-doors (a2 list prune and PERMISSION_DENIED on plain, /published, /layers, ?state=draft for a setup.access-only member, /history FORBIDDEN for that member and PERMISSION_DENIED for a studio.access member, admin control on every door; n0 the admin's ETag replayed by the member is 403, never 304, beside the admin's own 304); grant-table-write-contract (a1 permission_set_id 400 INVALID_FIELD and duplicate 409 UNIQUE_VIOLATION, a3 granted_by stores the caller) over POST /data/sys_user_permission_set; security-catalog-one-holder-http (a1 install-local 422 PLUGIN_REGISTER_FAILED naming showcase_auditor and com.example.showcase with GET /packages unchanged, a2 permission save with a foreign body packageId 400 VALIDATION_ERROR at packageId, a4 the clean boot's INFO line and, after 51 planted grants naming no set, the reboot's ERROR line with the grant ids capped at 50 and more: 1). Extended: showcase-anonymous-deny-surfaces (a2 admin leg of the retired /docs comparison, read-only, shared project), catalog-activation-door (a2 everyone/guest 400 with no row), permission-set-clone-door (a3 source's own name 409, closed body 400 VALIDATION_FAILED with nothing saved, anonymous 401), permission-set-assignment-window (a2 authored message, no 'unevaluable' constraint, valid-window 201 control). Ledger: the five items' automated.ref rewritten clause by clause; automated.kind unit -> dogfood on activation-write-operator-gate, platform-owner-email-anchor and record-view-read-audit (refs unchanged) and on security-catalog-one-holder-and-boot-report; each of the 8 items revision +1 with a history row citing #26571. No product code changed.",
  "tests": "Head abf45d31 (before a final origin/main merge that brought only plugin-auth's set-manager change, other area ledgers and unrelated dogfood files): the 8 touched dogfood files under os-verify-lock: Test Files 8 passed (8), Tests 127 passed (127), VERDICT command-exit 0; pnpm typecheck in packages/qa/dogfood exit 0 (6 GB heap). Closure rebuilt after the first main merge. First run measured three facts the pins now carry: GET /api/v1/keys answers the admin 405 (POST alone served), a scratch view column 'name' is refused at author time (showcase_task has 'title'), and install-local refuses an underscore in a package id with 400 PLUGIN_MANIFEST_INVALID. No ablation: tests and ledger text only.",
  "gates": "dispatch-gates --commands at 6f533694 derived 55; all 55 exit 0; --ran reconciles 55 derived, 55 run, 0 NOT-MEASURED. check-platform-checklist OK (16 areas, 329 items). PR check-runs: pending at report time.",
  "files_changed": "docs/qa/platform-checklist/areas/access-security.json; packages/qa/dogfood/test/anonymous-floor-v18-doors.dogfood.test.ts (new); packages/qa/dogfood/test/meta-view-audience-alternate-doors.dogfood.test.ts (new); packages/qa/dogfood/test/grant-table-write-contract.dogfood.test.ts (new); packages/qa/dogfood/test/security-catalog-one-holder-http.dogfood.test.ts (new); packages/qa/dogfood/test/showcase-anonymous-deny-surfaces.dogfood.test.ts; packages/qa/dogfood/test/catalog-activation-door.dogfood.test.ts; packages/qa/dogfood/test/permission-set-clone-door.dogfood.test.ts; packages/qa/dogfood/test/permission-set-assignment-window.dogfood.test.ts",
  "deviations": "automated.kind was also set to dogfood on security-catalog-one-holder-and-boot-report (not among the three the order named), because its rewritten ref now leads with dogfood pins; revert that one key if the seat prefers. The three kind-only items get a revision bump and history row with refs unchanged. PR body folds the PR template headings (Why, Human Minimum) into the os-dev section order.",
  "body_amendments": "none",
  "dogfood_battery": "n/a: no ! in the PR title and no (narrowing) arm",
  "mcp_calls": "0",
  "api_writes": "2 relay writes: pr_create (fleet-write run 40577614208, PR 26905, draft, assignee os-warren, label skip-changeset, 8550 bytes sent and stored identical) and this os-dev-report comment via post-stamped; plus git push (not a REST write)",
  "open_questions": [],
  "out_of_scope_findings": []
}

Generated by Claude Code

ACCEPT → PR #26905 comment 6453060530 · 2026-10-27T20:43Z

Generated by Claude Code

Landed: slice 3 via PR #26905, merged as 9f40488d53 · 2026-10-27T21:24Z

Five items are pinned at their oracle layer: anonymous-floor-v18-doors, meta-authoring-trail-and-audience-gates, security-catalog-activation-and-clone-doors, security-catalog-one-holder-and-boot-report and grant-table-write-contract (14 PARTIAL clauses at the api/log layer); automated.kind is now dogfood on the three slice-2 items and on security-catalog-one-holder-and-boot-report. ACCEPT → PR #26905 comment 6453060530. The card stays pm:dispatched, and the same card thread takes slice 4, the last, on the same branch (claim 6445125819 still holds): parent-and-organization-write-guards, deployment-tables-platform-only and share-link-combined-gates.

Generated by Claude Code

os-dev-report

{
  "issue": 26571,
  "status": "done",
  "slice": "4 of 4 (the last): access-security.parent-and-organization-write-guards, access-security.deployment-tables-platform-only, access-security.share-link-combined-gates (the seat's slice-4 order). PR says Fixes #26571: nothing remains after this slice.",
  "branch": "claude/project-thread-czmdl5",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/26941",
  "session": "session_01JQwxbWKBLcQCG7FBS17aMA",
  "premise_still_valid": true,
  "summary": "8 PARTIAL clauses now carry pins at the api oracle's layer (in-process HTTP), in three new isolated files in packages/qa/dogfood/test. parent-and-organization-write-guards: a1 on a multiTenant 'posture-only' boot (tenancy isolated, wall active, not degraded, asserted): an organization owner who is not the platform administrator PATCHes their showcase_private_note with organization_id null, 403 PERMISSION_DENIED, row keeps its org, the column-free PATCH admitted; inserts with organization_id null and '' stamped with the active org. a2/n0: a member whose scratch set writes showcase_task and whose row policy selects no showcase_project POSTs a task naming an unreadable seeded project and a nonexistent one, both 400 reference_not_found, bodies equal field by field after id normalisation, nothing lands, admin control lands; the same parity on the controlled_by_parent invoice line, where the ADR-0055 master-edit gate's 403 PERMISSION_DENIED answers first, byte-identical for both. deployment-tables-platform-only: a promoted org admin (organization_admin set, no manage_platform_settings, not platform admin, asserted) gets 403 PERMISSION_DENIED and the platform admin 200 on all seven tables; an organization_id filter is 400 INVALID_FIELD on each. share-link-combined-gates: link A (signed_in + password) answers anonymous 401 SIGN_IN_REQUIRED byte-identically to no, wrong and right password; link B (email + password) answers five non-entitled variants 404 INVALID_OR_EXPIRED byte-identical with an unknown token, allowlisted email + right password 200; /messages paired: 404 NOT_FOUND where resolve refused, 400 UNSUPPORTED on the one open call. Ledger: three refs rewritten clause by clause; kind unit -> dogfood (deployment-tables) and conformance -> dogfood (share-link); each revision +1 with a history row citing #26571. No clause left as a live leg. No product code changed.",
  "tests": "Head bc2b4dce (origin/main merged, closure rebuilt) under os-verify-lock: Test Files 3 passed (3), Tests 25 passed (25), VERDICT command-exit 0. pnpm typecheck in packages/qa/dogfood exit 0 (6 GB heap). A final no-overlap merge of main (892873d7) brought the crud-permission-matrix ledger row (#26923), app-shell fixes, docs and two refusals on doors these pins do not use. First runs measured two facts the file now carries: on the controlled_by_parent line the master-edit gate answers 403 before the reference check, and every showcase member reads projects through the stock baseline, so the scratch set narrows them with a row policy. No ablation: tests and ledger text only.",
  "gates": "dispatch-gates --commands at bc2b4dce derived 55; all 55 exit 0; --ran reconciles 55 derived, 55 run, 0 NOT-MEASURED. check-platform-checklist OK (16 areas, 329 items) after both merges. PR check-runs: pending at report time.",
  "files_changed": "docs/qa/platform-checklist/areas/access-security.json; packages/qa/dogfood/test/parent-and-organization-write-guards.dogfood.test.ts (new); packages/qa/dogfood/test/deployment-tables-platform-only.dogfood.test.ts (new); packages/qa/dogfood/test/share-link-combined-gates.dogfood.test.ts (new)",
  "deviations": "a2 reference_not_found is pinned on showcase_task (a plain master_detail detail) rather than the controlled_by_parent fixture the item names, because the cbp master-edit gate answers 403 first there; the cbp parity is pinned too, as one byte-identical 403. If the seat reads the clause as requiring 400 on the cbp fixture, that is a clause question. The walled knownGaps text is unchanged (it describes the live run's os serve fixture). PR body folds the PR template headings (Why, Human Minimum) into the os-dev section order.",
  "body_amendments": "none",
  "dogfood_battery": "n/a: no ! in the PR title and no (narrowing) arm",
  "mcp_calls": "0",
  "api_writes": "2 relay writes: pr_create (fleet-write run 40594548951, PR 26941, draft, assignee os-warren, label skip-changeset, 8699 bytes sent and stored identical) and this os-dev-report comment via post-stamped; plus git push (not a REST write)",
  "open_questions": [],
  "out_of_scope_findings": []
}

Generated by Claude Code

ACCEPT → PR #26941 comment 6455496269 · auto-merge armed · 2026-10-27T22:49Z

Landed: slice 4 (the last), with the write-guard, deployment-table and share-link pins over HTTP, via PR #26941, merged as 912076f885 · 2026-10-27T23:24Z

Navigation Menu

Repository navigation

qa(checklist): access-security — pin the Tier 1 clauses the 18.2.0 sweep scored partial at the layer their oracle names (18 items) #26571

Items and clauses (from #26468's close-out, wave anchor #25807)

Done when

Triage: first grade — `tests` · `priority:p2` · `domain:devx` · `area:devpath` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-27T08:57Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

qa(checklist): access-security — pin the Tier 1 clauses the 18.2.0 sweep scored partial at the layer their oracle names (18 items) #26571

Description

Items and clauses (from #26468's close-out, wave anchor #25807)

Done when

Activity

objectstack-fleet commented on Oct 27, 2026

Triage: first grade — tests · priority:p2 · domain:devx · area:devpath · pm:queue · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-27T08:57Z

objectstack-fleet commented on Oct 27, 2026

objectstack-fleet commented on Oct 27, 2026

objectstack-fleet commented on Oct 27, 2026

objectstack-fleet commented on Oct 27, 2026

objectstack-fleet commented on Oct 27, 2026

objectstack-fleet commented on Oct 27, 2026

objectstack-fleet commented on Oct 27, 2026

objectstack-fleet commented on Oct 27, 2026

objectstack-fleet commented on Oct 27, 2026

objectstack-fleet commented on Oct 27, 2026

objectstack-fleet commented on Oct 27, 2026

objectstack-fleet commented on Oct 27, 2026

objectstack-fleet commented on Oct 27, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: first grade — `tests` · `priority:p2` · `domain:devx` · `area:devpath` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-27T08:57Z